LDAP - Unable to map account and entitlements

[pschoch]

We have a connection setup with Tivoli LDAP. We are able to import Accounts and Entitlements, but the association between account-entitlements is not mapping. 

groupImportMapping:

{
"importGroupHierarchy": "true",
"entitlementTypeName": "uniqueMember",
"performGroupAccountLinking": "true",
"incrementalTimeField": "whenChanged",
"groupObjectClass": "(objectClass=groupOfUniqueNames)",
"groupAccountMappingAttributeName":"uniquemember",
"mapping":"memberHash:uniquemember_char,customProperty12:nameinnamespace_char,customProperty13:cn_char,entitlement_value:nameinnamespace_char,entitlementID:nameinnamespace_char,DISPLAYNAME:cn_char,RECONCILATION_FIELD:entitlement_value"
}

 We've confirmed 'uniquemember' property contains the list of accounts in distinguishname format. 

And have account_attribute setup 

ACCOUNTID::nameinnamespace#String

[rushikeshvartak]

. Ensure Proper DN Format in Account Attributes

• Since the uniquemember field holds the DN of accounts, make sure that the nameinnamespace field in the account is populated correctly and in the proper DN format.
• Verify that the value of nameinnamespace matches the format of the DN in uniquemember, as this field is being used for mapping.

2. Check the groupAccountMappingAttributeName Configuration

• The groupAccountMappingAttributeName is currently set to uniquemember, which is correct for your case as uniquemember holds the DNs of accounts.
• This field should correctly link the accounts listed under uniquemember to the nameinnamespace in the account, as it is being used to reconcile them.

3. Review Account Attribute Mapping

• In the account attribute setup, you have ACCOUNTID::nameinnamespace#String. Ensure that nameinnamespace is populated in the correct format, and that it matches the values in the uniquemember property of the entitlements.

[stalluri]

@pschoch 
Along with the below, can you also make sure you're selecting 
ENTITLEMENT_ATTRIBUTE as uniqueMember

[pschoch]

@rushikeshvartak 

I can confirm the dn formatting of accounts, defined by nameinnamespace, matches the dn format in the uniquemember property. We populated a customproperty with the value of uniquemember and format matches.

For example, the given account:

AccountID: employeeNumber=123456,ou=People,o=xxx,c=ca

and given entitlement that has uniquemember attribute as:

 [employeeNumber=123456,ou=People,o=xxx,c=ca, employeeNumber=123457,ou=People,o=xxx,c=ca]

@stalluri 

Also can confirm, ENTITLEMENT_ATTRIBUTE is defined as uniqueMember

[NM]

@pschoch , can you try one thing.

Run account import see if it maps account and entitlement then access see if it anyway it changes it?

[rushikeshvartak]

Could you kindly provide a detailed snapshot of the information extracted from the logs, encompassing errors and other pertinent functionality details encountered during the execution of this process? Your assistance in furnishing this information would greatly aid in the analysis and resolution of any issues .



‼️‼️⚠️Do not upload any attachments that contain sensitive information, such as IP Addresses, URLs, Company/Employee Names, Email Addresses, etc.⚠️‼️‼️

[pschoch]

Is there a search term i should be looking for in the logs? There's no errors within the runtime window. I see all the expected entitlements and accounts imported, the counts are correct. 

The one thing i noticed near the end of the runtime is several entries that show as the following, almost like its trying to associate values in the dn value.

[rushikeshvartak]

There is no particular keyword need to dig into logs

[NM]

@pschoch I will say share logs in text format